@plainconceptsplatform/workflows 1.6.0 → 1.6.11

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -493,6 +493,14 @@ if [ "$BELT_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # trailing space, so a number at the end of a body is still followed by a non-digit, and the
 # pattern matches `[^0-9]`. Four quoting layers cannot eat a character class.
 SWEEP_OK=1
+# The live runs come from status-filtered queries. Reading the repository's latest hundred runs of
+# any kind let a long-queued implement fall out of the window, and the sweep cleared bot-working
+# from issues whose runs were alive (Pliny-Bot #693 and #707).
+if grep -q 'gh api "repos/\$REPO/actions/runs?per_page=100"' "$ROUTER_YML" ||
+  ! grep -qF 'actions/runs?status=$status&per_page=100' "$ROUTER_YML"; then
+  SWEEP_OK=0
+  echo "FAIL: the stale-reservation sweep must read live runs by status, not the latest hundred runs" >&2
+fi
 if ! grep -qF 'test(\"#${issue}[^0-9]\")' "$ROUTER_YML"; then
   SWEEP_OK=0
   echo "FAIL: the stale-reservation sweep does not match a run title with a character class; a word boundary there is eaten by bash and jq" >&2
@@ -688,12 +696,15 @@ if worker_installed merge-gate; then
   # The merge belt is serial for the whole repository: several overnight pull requests
   # mean every merge moves the default branch under the rest, and gates running at once
   # rebase onto bases other gates are about to invalidate. A per-issue group here would
-  # reintroduce that race, so assert the repo-wide lock is the one in use.
-  if grep -A7 'call-merge-gate:' "$ROUTER_YML" | grep -q 'group: merge-belt'; then
+  # reintroduce that race, so assert the repo-wide lock is the one in use. The exception is a gate
+  # handed red CI: it repairs and pushes and can never merge, so it queues per pull request.
+  gate_group="$(sed -n '/^  call-merge-gate:/,/^    permissions:/p' "$ROUTER_YML" | grep 'group:')"
+  if grep -q "'merge-belt'" <<<"$gate_group" &&
+    grep -q "ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number)" <<<"$gate_group"; then
     PASS=$((PASS + 1))
   else
     FAIL=$((FAIL + 1))
-    echo "FAIL: call-merge-gate must hold the repo-wide merge-belt lock" >&2
+    echo "FAIL: call-merge-gate must queue on merge-belt, and only a gate handed red CI may queue per pull request instead" >&2
   fi
 fi
 
@@ -719,7 +730,9 @@ if worker_installed merge-gate; then
     # One gate at a time, found by the title run-name gives it. The belt looked for a title that
     # run-name had stopped producing, saw no live gate ever, and dispatched #680 five times in
     # an hour onto a belt that runs one gate at a time.
-    gate_title="$(sed -n "s/.*format('\(Agent: Merge Gate - PR #\){0}'.*/\1/p" "$ROUTER_YML" | head -1)"
+    gate_title="$(sed -n "s/.*format('\(Agent: Merge Gate - PR #\){0}{1}'.*/\1/p" "$ROUTER_YML" | head -1)"
+    grep -q "' (repair)'" "$ROUTER_YML" ||
+      { BELT_OK=0; echo "FAIL: run-name must mark a gate handed red CI as a (repair), the train counts them by it" >&2; }
     if [ -z "$gate_title" ] || ! grep -qF "GATE_TITLE_PREFIX=\"${gate_title}\"" "$TRAIN_SH"; then
       BELT_OK=0
       echo "FAIL: the train looks for live gates titled differently from what run-name names them ('${gate_title:-unread}')" >&2
@@ -1771,6 +1784,151 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
   if [ "$VALIDATOR_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+# The gate takes any pull request the train hands it. A subject check that refuses one without
+# leaving a verdict or an attempt is a loop: the train cannot tell a gate that declined from a gate
+# that has not run. Refusals are for what the train never hands over (a fork, a stranger, a pull
+# request that is not open), and the train filters those itself.
+if worker_installed merge-gate; then
+  # check-diff exiting 1 is the `fail` the code_rules job reports. Under GitHub's `bash -e` a bare
+  # assignment from it ends the step, so the report is never recorded and the gate burns its
+  # budget on a failure it could have repaired.
+  if grep -qF 'check-diff.mjs --base "$BASE" 2>&1) || code=$?' "$MERGE_GATE_WORKER_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: code_rules must capture check-diff's exit code with || code=\$?; a bare assignment dies under bash -e" >&2
+  fi
+  # A run killed by its infrastructure is repeated whatever its duration; one the agent got wrong is
+  # not. The two signatures are read from places a tool's output cannot write: GitHub's annotations
+  # for the runner shutdown, and the line above the sandbox teardown for an engine cut off one turn
+  # after it asked the model something (Pliny-Bot #699 and #693's first attempt).
+  CLASSIFY="${HERE}/../decide-agent-retry/classify-failure.sh"
+  if [ -f "$CLASSIFY" ]; then
+    ctmp="$(mktemp -d)"
+    printf '%s
+' '2026-10-16T22:13:03Z > ci-workflow-agent · glm-5-2' '2026-10-16T22:13:05Z the grep printed a line' '2026-10-16T22:13:36Z > ci-workflow-agent · glm-5-2' '2026-10-16T22:13:37Z [INFO] Stopping containers...' >"$ctmp/cutoff.log"
+    printf '%s
+' '2026-10-16T22:13:03Z > ci-workflow-agent · glm-5-2' '2026-10-16T22:13:36Z Done. The pull request is ready.' '2026-10-16T22:13:37Z [INFO] Stopping containers...' >"$ctmp/done.log"
+    printf '%s
+' '2026-10-16T22:13:03Z the log quotes: Process completed with exit code 143 and The runner has received a shutdown signal' '2026-10-16T22:13:04Z Done.' '2026-10-16T22:13:37Z [INFO] Stopping containers...' >"$ctmp/quoted.log"
+    printf '%s
+' 'Process completed with exit code 143.' 'Property x does not exist' >"$ctmp/sigterm.ann"
+    printf '%s
+' 'Process completed with exit code 137.' >"$ctmp/sigkill.ann"
+    printf '%s
+' 'Process completed with exit code 1.' >"$ctmp/plain.ann"
+    assert "an engine stopped one turn after its request is a cut-off" cut-off "$(bash "$CLASSIFY" "$ctmp/cutoff.log" "")"
+    assert "a run that said its piece is not a cut-off" none "$(bash "$CLASSIFY" "$ctmp/done.log" "")"
+    assert "a tool quoting the shutdown text does not count" none "$(bash "$CLASSIFY" "$ctmp/quoted.log" "")"
+    assert "exit 143 in the annotations is a runner shutdown" runner-shutdown "$(bash "$CLASSIFY" "$ctmp/done.log" "$ctmp/sigterm.ann")"
+    assert "exit 137 (an out-of-memory kill) is repeated by nobody" none "$(bash "$CLASSIFY" "$ctmp/done.log" "$ctmp/sigkill.ann")"
+    assert "an ordinary failure is not infrastructure" none "$(bash "$CLASSIFY" "$ctmp/done.log" "$ctmp/plain.ann")"
+    assert "nothing to read classifies as nothing" none "$(bash "$CLASSIFY" "" "")"
+    rm -rf "$ctmp"
+  fi
+  # The implement worker carried its own copy of the retry rule while four other workers used the
+  # shared action, so a rule fixed in one place stayed broken in the other.
+  IMPLEMENT_MD="${WORKFLOWS_DIR}/agent-implement.md"
+  if [ -f "$IMPLEMENT_MD" ]; then
+    uses=$(count -c "uses: ./.github/actions/decide-agent-retry" "$IMPLEMENT_MD")
+    if [ "$uses" -ge 2 ] && ! grep -q 'minutes=$(( ( $(date -u -d "$finished"' "$IMPLEMENT_MD"; then
+      PASS=$((PASS + 1))
+    else
+      FAIL=$((FAIL + 1))
+      echo "FAIL: agent-implement.md must decide a retry through the shared decide-agent-retry action, in both incomplete and conclude" >&2
+    fi
+  fi
+  # Implement runs spread over IMPLEMENT_PARALLELISM queues, but the children of one refine share
+  # a queue keyed on their split parent: they build on each other's code. The queue step's
+  # arithmetic is exercised with the same expression the router runs.
+  if grep -q 'group: implement-queue-${{ needs.check-stack-branch.outputs.implement-queue' "$ROUTER_YML" &&
+    sed -n '/- name: Pick the implement queue/,/- name: Resolve the feature branch/p' "$ROUTER_YML" | grep -q 'key="${parent:-$ISSUE_NUMBER}"'; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: call-implement must queue on check-stack-branch's implement-queue, keyed on the split parent" >&2
+  fi
+  queue_for() { local parent="$1" issue="$2" queues="$3"; case "$queues" in ''|*[!0-9]*|0) queues=1 ;; esac; local key="${parent:-$issue}"; echo $(( key % queues )); }
+  assert "siblings of one refine share a queue" "$(queue_for 690 693 3)" "$(queue_for 690 694 3)"
+  assert "parallelism 1 is one queue for everything" 0 "$(queue_for "" 722 1)"
+  assert "an unset or garbled parallelism is one queue" 0 "$(queue_for "" 725 abc)"
+  assert "independent issues spread across the queues" 1 "$(queue_for "" 724 3)"
+  # The router queues implement runs FIFO, so a run waiting an hour behind the one in progress is
+  # healthy. The janitor cancelling every pending run over an hour old took every issue queued
+  # behind the first out of the queue and left it holding bot-working (Pliny-Bot #706, #644).
+  if [ -f "${HERE}/../housekeeping/action.yml" ] && ! grep -q "liveKinds" "${HERE}/../housekeeping/action.yml"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the janitor cancels pending runs without checking for a live run of their own kind ahead of them" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+  # The implement worker names every phase skill it must load. Left as "load each phase skill",
+  # glm-5-2 loaded pc-plan-goal, wrote proposal.md and tasks.md itself and edited the code alone:
+  # a hand-written tasks.md has no <!-- agent --> annotations, so pc-plan-apply had no subagents
+  # to spawn and the whole change ran on one model, in sequence (Pliny-Bot #693, #699).
+  IMPL_MD="${WORKFLOWS_DIR}/agent-implement.md"
+  if [ -f "$IMPL_MD" ]; then
+    if grep -q 'You never write' "$IMPL_MD" && grep -q '`pc-plan-propose`, even when the issue is refined' "$IMPL_MD" &&
+      grep -q 'In this phase you do not edit source files' "$IMPL_MD" && grep -q '`pc-repo-verify`, then `pc-plan-archive`' "$IMPL_MD"; then
+      PASS=$((PASS + 1))
+    else
+      FAIL=$((FAIL + 1))
+      echo "FAIL: agent-implement.md must name pc-plan-propose, pc-plan-apply, pc-repo-verify and pc-plan-archive and forbid writing tasks.md by hand" >&2
+    fi
+  fi
+  # Refine writes in English and may retitle an issue written in another language; without
+  # allow_title on update-issue the title in the call is dropped and the issue keeps its language.
+  REFINE_MD="${WORKFLOWS_DIR}/agent-refine.md"
+  if [ -f "$REFINE_MD" ]; then
+    if sed -n '/^  update-issue:/,/^  add-comment:/p' "$REFINE_MD" | grep -q '^    title:' &&
+      grep -q 'Everything you write is in English' "$REFINE_MD"; then
+      PASS=$((PASS + 1))
+    else
+      FAIL=$((FAIL + 1))
+      echo "FAIL: agent-refine.md must write in English and be allowed to retitle an issue (update-issue title:)" >&2
+    fi
+  fi
+  # A token written to the runner's global git config outlives the job on a runner that is reused:
+  # rules for revoked tokens pile up for the same prefix and git picks one at random, so the same
+  # gate pushed for one pull request and was refused for the next (Pliny-Bot #716 and #717).
+  PUSH_ACTION="${HERE}/../push-agent-branch/action.yml"
+  if [ -f "$PUSH_ACTION" ] && grep -qE 'git config( --global)? url\.' "$PUSH_ACTION" && ! grep -qF 'git config --local url.' "$PUSH_ACTION"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: push-agent-branch writes its token to the global git config, where stale rules from earlier jobs accumulate" >&2
+  elif [ -f "$PUSH_ACTION" ] && grep -qE 'git config --global url\.' "$PUSH_ACTION"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: push-agent-branch adds to the global git config; set the rule with --local" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+  # A conclude that dies leaves no verdict and no attempt comment unless `incomplete` records it,
+  # and the train then reads the run as a gate that did nothing and never offers the pull request
+  # again.
+  if sed -n '/^  incomplete:/,/^    runs-on:/p' "$MERGE_GATE_WORKER_MD" | grep -q "needs.conclude.result == 'failure'"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the gate's incomplete job must record a failed conclude as an attempt, or the train strands the pull request" >&2
+  fi
+  # A stack child is dispatched on its feature branch, and a dispatched run reads repository secrets
+  # by their own names, not through the router's FORGE_API_KEY mapping. Without the fallback every
+  # stack child died at activation on "Validate CODEX_API_KEY or OPENAI_API_KEY secret".
+  COMPILE_SCRIPT="${HERE}/../../scripts/compile-agent-workflows.mjs"
+  if [ -f "$COMPILE_SCRIPT" ] && ! grep -qF "secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY" "$COMPILE_SCRIPT"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the compile script no longer gives the engine key a FORGE_API_KEY fallback; dispatched stack children cannot start" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+  SUBJECT_YML="${HERE}/../identify-gate-subject/action.yml"
+  if grep -qE 'does not close a numbered issue|does not carry' "$SUBJECT_YML" || grep -q 'require-label' "$SUBJECT_YML" "$MERGE_GATE_WORKER_MD"; then
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the gate's subject job refuses a pull request for lacking an issue or a label; the train hands it back forever" >&2
+  else
+    PASS=$((PASS + 1))
+  fi
+fi
+
 echo "── Merge gate park ───────────────────────────────────────────────────────"
 
 # A gate verdict parks the code it was given on. The belt used to compare the standing verdict
@@ -1813,10 +1971,19 @@ if worker_installed merge-gate; then
     assert "requested changes keep it off the train" skip "$(move REVIEW_DECISION=CHANGES_REQUESTED CI_STATUS=completed CI_CONCLUSION=success)"
     assert "a parked pull request is passed by, not waited on" skip "$(move PARK=held CI_STATUS=completed CI_CONCLUSION=success)"
     assert "a spent attempt budget is passed by" skip "$(move ATTEMPTS=6 MAX_ATTEMPTS=6 CI_STATUS=completed CI_CONCLUSION=failure)"
+    # The loop that ran Pliny-Bot's gate twenty times on one pull request: the gate declined it
+    # (its issue was closed), left no verdict and no attempt, and every tick handed it back.
+    assert "a gate that ran and left no trace is not asked again" skip "$(move SILENT_GATE=true MERGEABLE=CONFLICTING CI_STATUS=none)"
+    assert "a gate that ran and left no trace is not asked again, green or red" skip "$(move SILENT_GATE=true MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure)"
     assert "a conflict goes to the gate even with no CI" gate "$(move MERGEABLE=CONFLICTING CI_STATUS=none)"
     assert "running CI is waited on" wait "$(move MERGEABLE=MERGEABLE CI_STATUS=in_progress)"
     assert "CI stuck past the limit is passed by" skip "$(move MERGEABLE=MERGEABLE CI_STATUS=queued CI_STUCK=true)"
     assert "red CI goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure)"
+    # A red base branch cost every open Pliny-Bot pull request its repairs for seven hours: the
+    # failures were main's, and the gate spent attempts on code that was not at fault.
+    assert "a failure that is main's too is waited out, not repaired" wait "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
+    assert "a failure that is not main's still goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=false)"
+    assert "a conflict is still the gate's even when main is red" gate "$(move MERGEABLE=CONFLICTING CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
     assert "green but behind is brought up to date first" update "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=success BEHIND_BY=2)"
     assert "green and current goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=success BEHIND_BY=0)"
     assert "no CI run is passed by" skip "$(move MERGEABLE=MERGEABLE CI_STATUS=none)"
@@ -2568,7 +2735,7 @@ if [ "$INPUT_WIRING_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)
 BELT_QUEUE_OK=1
 belt_caller=$(awk '/^  call-merge-gate:/ { found = 1; print; next } found && /^  [a-z]/ { exit } found { print }' "$ROUTER_YML")
 printf '%s
-' "$belt_caller" | grep -qE '^ *group: merge-belt *$' ||
+' "$belt_caller" | grep -qE "^ *group: .*'merge-belt'" ||
   { BELT_QUEUE_OK=0; echo "FAIL: the merge gate is no longer serialised on the merge-belt concurrency group" >&2; }
 printf '%s
 ' "$belt_caller" | grep -qE '^ *queue: max *$' ||
@@ -2596,6 +2763,11 @@ if worker_installed merge-gate; then
       GATE_RUN_ID_OK=0
       echo "FAIL: identify-gate-subject resolves the CI run only when the conclusion is unknown; a router that passes both gets an empty run ID" >&2
     fi
+    # A verdict from a run that judged an older head is not a verdict on this one (Pliny-Bot #729).
+    grep -Fq '"$run_sha" != "$current_sha"' "$GATE_SUBJECT_ACTION" ||
+      { GATE_RUN_ID_OK=0; echo "FAIL: identify-gate-subject trusts the carried CI run even when it judged an older head" >&2; }
+    grep -Fq 'select(.status == "completed")' "$GATE_SUBJECT_ACTION" ||
+      { GATE_RUN_ID_OK=0; echo "FAIL: identify-gate-subject re-reads a stale verdict without requiring a finished run on the head" >&2; }
   fi
 # Repeating a report the validator refused reproduces it, and every repeat is a fresh agent run
 # holding the repo-wide merge-belt slot. The worker gives that failure a smaller budget than a

package/loops/docs/diagrams.md

@@ -94,7 +94,7 @@ flowchart LR
     gate -->|merge| merged(("Merged"))
     merged -->|"next PR"| train
     gate -.->|"CI failed or conflict"| fix("Fix, push, CI again") --> ci
-    gate -.->|".github, secrets<br/>or 1000+ lines"| human(("Human review"))
+    gate -.->|".github, secrets<br/>or 10000+ lines"| human(("Human review"))
     review("Someone reviews the PR") --> applyReview("apply-review") --> ci
     audit("audit, weekly") -->|"files one issue"| refine
 
@@ -381,7 +381,7 @@ flowchart TD
     gateDisposition -->|"no verified blocker,<br/>radius low or recoverable medium"| gateRootCheck
     gateRootCheck{"PR base is a<br/>stack feature branch<br/>and this PR is the root?"}
     gateRootCheck -->|"child PR: no"| gateMerge
-    gateDisposition -.->|"1000+ lines, .github/<br/>or a secret"| gateOwner
+    gateDisposition -.->|"10000+ lines, .github/<br/>or a secret"| gateOwner
     gateDisposition -.->|"fragile, unmet criteria<br/>or low confidence"| gateHuman
     gateDisposition -.->|"CI red or a verified<br/>high finding"| gateBlocked
     gateMerge(("AUTO-MERGE<br/>squash into the PR's base<br/>(main, or the feature branch:<br/>then the child issue closes,<br/>pr-pending removed)"))

package/loops/scripts/compile-agent-workflows.mjs

@@ -331,7 +331,19 @@ for (const file of readdirSync(workflowDirectory)) {
     // runner rather than the run so a runner keeps its server warm between its own jobs.
     // No double quotes here: the enclosing run: is a double-quoted YAML scalar, so a quote
     // would have to be escaped. The default has no spaces, so bare is safe shell.
-    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}');
+    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}')
+    // The engine key falls back to FORGE_API_KEY, the one secret every repository here has. The
+    // router maps it to OPENAI_API_KEY when it CALLS a worker, but a stack child is DISPATCHED on
+    // its feature branch, and a dispatched run reads repository secrets by their own names: with
+    // no OPENAI_API_KEY or CODEX_API_KEY set, activation died on "Validate CODEX_API_KEY or
+    // OPENAI_API_KEY secret" and every stack child in Pliny-Bot failed that way for hours. gh-aw
+    // reads the key in four places, the validation step, the engine env and the redaction list
+    // included, and all of them must see the fallback or the key would run unredacted. The
+    // longest form goes first so the shorter ones do not match inside it.
+    .replaceAll('${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}',
+      '${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY }}')
+    .replaceAll('${{ secrets.CODEX_API_KEY }}', '${{ secrets.CODEX_API_KEY || secrets.FORGE_API_KEY }}')
+    .replaceAll('${{ secrets.OPENAI_API_KEY }}', '${{ secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY }}');
 
   let rewritten = patched;
   // A queued implement executes hours after its run was created, but actions/checkout
@@ -340,8 +352,8 @@ for (const file of readdirSync(workflowDirectory)) {
   // every later push became a rebase onto a moved parent, which gh-aw's signed-commit
   // push cannot do (it dies with "cannot rebase: You have unstaged changes" and files the
   // pull request as an issue instead of a pull request). Checking out the branch tip at
-  // execution time makes the commit parent current main; the implement-global queue
-  // already keeps sibling merges out of the window while the agent runs.
+  // execution time makes the commit parent current main; the implement queue, shared by the
+  // children of one refine, keeps sibling merges out of the window while the agent runs.
   //
   // A stack child dispatches this workflow directly (`gh workflow run
   // agent-implement.lock.yml --ref feat/N`), and there the pin must select the feature
@@ -415,6 +427,11 @@ for (const file of readdirSync(workflowDirectory)) {
   for (const check of [
     { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
     { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
+    // Every read of the engine key carries the FORGE_API_KEY fallback; see the rewrite above.
+    {
+      name: "engine key falls back to FORGE_API_KEY",
+      ok: lock => !lock.includes("${{ secrets.OPENAI_API_KEY }}") && !lock.includes("${{ secrets.CODEX_API_KEY }}"),
+    },
     { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
     // Only agent-refine declares update_issue; the other workers never carry the tool.
     {

package/loops/workflows/agent-implement.md

@@ -185,7 +185,7 @@ jobs:
           fi
 
           # A queued implement run can start long after it was dispatched. If triage concluded
-          # needs-maintainer while this run waited in the implement-global queue, the issue now
+          # needs-maintainer while this run waited in its implement queue, the issue now
           # carries review and the verdict must stand: the reserve step clears review blindly,
           # so eligibility has to catch it first (Pliny-Bot #372).
           if jq -e 'index("review")' >/dev/null <<<"$labels"; then
@@ -245,6 +245,8 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
+      # reads the agent job's log and annotations, and re-enters through the router on a retry
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -433,8 +435,48 @@ jobs:
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.PATCH_WITHOUT_REQUEST_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-      - name: Flag a run that produced nothing
+      # A run that ends with nothing is not always the agent's verdict. The AI gateway can answer
+      # nothing and end the engine one turn after it began, and the runner's VM can be taken away
+      # mid-job; neither says the work was wrong, and parking them for the janitor cost up to six
+      # hours each (Pliny-Bot #693's first attempt). The shared rule repeats those, and a run that
+      # died young, within the attempt budget.
+      - name: Decide whether an empty run is worth repeating
+        id: empty_retry
         if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far || '0' }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      - name: Report the retried empty run
+        if: steps.empty_retry.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.ATTEMPT_MARKER }}
+            Attempt ${{ steps.empty_retry.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended with nothing after ${{ steps.empty_retry.outputs.minutes }} minutes (${{ steps.empty_retry.outputs.cause }}). That is what a provider or runner outage looks like, not a verdict on the work, so this is being retried.
+            The issue keeps `implement`.
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Send the issue back through the router
+        if: steps.empty_retry.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          ISSUE_NUMBER: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.empty_retry.outputs.next }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=implement -f issue-number="$ISSUE_NUMBER" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched implement for #$ISSUE_NUMBER as attempt $NEXT."
+      - name: Flag a run that produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true' && steps.empty_retry.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -443,7 +485,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say the run produced nothing
-        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
+        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true' && steps.empty_retry.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -478,36 +520,17 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      # The shared rule, which this worker used to carry its own copy of. It repeats a run that died
+      # young, and now also one that was killed after a long time: the runner's VM taken away
+      # mid-job, or the AI gateway answering nothing and ending the engine one turn after it began.
       - name: Decide whether this failure is worth repeating
         id: decide
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          ATTEMPTS: ${{ inputs.attempts_so_far || '0' }}
-          PARK_AT: ${{ env.PARK_AT_ATTEMPT }}
-          UNDER_MINUTES: ${{ env.RETRY_UNDER_MINUTES }}
-        run: |
-          set -euo pipefail
-          # The agent job belongs to this same run: a called workflow shares the caller's run id.
-          read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
-            --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                  | "\(.started_at // "") \(.completed_at // "")"')"
-          minutes=-1
-          if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
-            minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
-          fi
-          retry=false
-          # An unknown duration is treated as a long run: never retry on a guess.
-          if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$ATTEMPTS" -lt "$PARK_AT" ]; then
-            retry=true
-          fi
-          {
-            echo "retry=$retry"
-            echo "next=$((ATTEMPTS + 1))"
-            echo "minutes=$minutes"
-          } >> "$GITHUB_OUTPUT"
-          echo "agent job ran for ${minutes}m; attempts so far ${ATTEMPTS}; retry=${retry}"
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far || '0' }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
       # The attempt is recorded before any label moves, so a failure in the steps below leaves a
       # run that can be counted rather than an issue released with nothing to show for it.
       - name: Report the failed attempt
@@ -518,7 +541,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           body: |
             ${{ env.ATTEMPT_MARKER }}
-            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer. That is what a provider outage looks like, so this is being retried.
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes without an answer (${{ steps.decide.outputs.cause }}). That is what a provider or runner outage looks like, not a verdict on the work, so this is being retried.
             The issue keeps `implement`.
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
       - name: Release the reservation for the retry
@@ -571,6 +594,7 @@ jobs:
           body: |
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.INCOMPLETE_COMMENT }}
+            What ended: the agent job was **${{ needs.agent.result }}** after ${{ steps.decide.outputs.minutes }} minutes (-1 when that could not be read), and publishing its output was **${{ needs.safe_outputs.result }}**.
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
   agent:
     needs: [eligibility]
@@ -703,6 +727,28 @@ timeout-minutes: 180
    phase skill it names, in order, and do not explore the code yourself where it says a phase
    is skipped.
 
+   **The pipeline is these skill loads, in this order, each a call to the Skill tool.** A run
+   that edits source files without having made them has skipped the pipeline, whatever it
+   wrote instead:
+
+   1. `pc-plan-goal`, then Phase 0 as it describes.
+   2. `pc-plan-propose`, even when the issue is refined. It is what turns the issue into
+      `openspec/changes/<id>/tasks.md` with every task annotated
+      `<!-- agent: <engineer>.<tier>, depends_on: [...], touches: [...] -->`. **You never write
+      `proposal.md` or `tasks.md` yourself.** A hand-written `tasks.md` carries no annotations,
+      and without them `pc-plan-apply` has no workers to spawn, so the whole change is done by
+      you alone, in sequence, on one model. That is the failure this step exists to prevent.
+   3. `pc-plan-apply`. The tasks are implemented by the subagents it spawns, in waves, each on
+      the model tier its annotation names. **In this phase you do not edit source files
+      yourself.** If it stops because a worker cannot be resolved, report that with
+      `report_incomplete`, naming the task and the missing worker; do not do the task yourself
+      to get past it.
+   4. `pc-repo-verify`, then `pc-plan-archive`, as `pc-plan-goal` directs.
+
+   Before the first edit to a source file, check that
+   `openspec/changes/<id>/tasks.md` exists and that its tasks carry the annotation above. If it
+   does not, you have not run `pc-plan-propose`: load it now.
+
    a. `branch` is the output mode this sandbox needs: the branch is kept, nothing is merged and
       nothing is pushed. Without it the skill merges into the local default branch and deletes
       the feature branch, and step 6 below then opens a pull request from a branch that is

package/loops/workflows/agent-merge-gate.md

@@ -37,11 +37,12 @@ env:
   # infrastructure used to stop a merge from here; they are the review pass's to look at now, and
   # a migration that rewrites data still parks through a `low` recoverability the agent evidences.
   SENSITIVE_PATHS: '(^|/)([Dd]omain|entities|[Cc]ontracts)/|(^|/)([Aa]uth|[Aa]uthn|[Aa]uthz|[Aa]uthentication|[Aa]uthorization|[Ii]dentity|[Ss]ecurity|[Mm]igrations|[Ii]nfra|terraform|helm|k8s|deploy)(/|[A-Z][A-Za-z]*\.[a-z]+$)'
-  # Diff shape. Lines decide high: a change over a thousand counted lines (tests, docs,
-  # translations and generated code excluded) is too big to merge unseen. A file count alone
-  # never does, so the high file threshold is set out of reach; spread still raises medium.
+  # Diff shape. Lines decide high: a change over ten thousand counted lines (tests, docs,
+  # translations and generated code excluded) is too big to merge unseen. It was a thousand, which
+  # is a normal feature once the tests are left out. A file count alone never decides, so the high
+  # file threshold is set out of reach; spread still raises medium.
   BLAST_HIGH_FILES: "100000"
-  BLAST_HIGH_LINES: "1000"
+  BLAST_HIGH_LINES: "10000"
   BLAST_MEDIUM_FILES: "5"
   BLAST_MEDIUM_LINES: "200"
   # Paths that change no runtime behaviour: tests, docs, specs, translations and generated
@@ -182,7 +183,6 @@ jobs:
           ci-conclusion: ${{ inputs.ci-conclusion }}
           ci-run-id: ${{ inputs.ci-run-id }}
           linked-issue: ${{ inputs.linked-issue }}
-          require-label: ${{ env.IMPLEMENT_LABEL }}
           trusted-bots: ${{ env.TRUSTED_BOTS }}
       - name: Block a pull request with requested changes
         id: review
@@ -320,8 +320,13 @@ jobs:
             echo "check-diff is not installed (agent-harness 3.2.0 or later ships it), so comments and tests were not checked." >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
-          report=$(node .opencode/scripts/check-diff.mjs --base "$BASE" 2>&1)
-          code=$?
+          # `|| code=$?`, not a bare `code=$?` on the next line. GitHub runs this under `bash -e`,
+          # and `set -uo pipefail` above does not undo it, so a check-diff that exited 1 (the
+          # `fail` this step exists to report) ended the step there: the job failed, the agent
+          # was skipped, and the pull request burned its whole attempt budget on a verdict that
+          # was never recorded (Pliny-Bot #686, six attempts in twenty minutes).
+          code=0
+          report=$(node .opencode/scripts/check-diff.mjs --base "$BASE" 2>&1) || code=$?
           case "$code" in 0) result=pass ;; 1) result=fail ;; *) result=error ;; esac
           delimiter="EOF_$(openssl rand -hex 8)"
           {
@@ -691,8 +696,12 @@ jobs:
             ${{ env.OWNER_REVIEW_LABEL }}
             ${{ env.BLOCKED_LABEL }}
             ${{ env.PR_PENDING_LABEL }}
+  # A conclude that dies (a push refused, a token rejected) is a failed attempt too. Without it
+  # here the run left no verdict and no attempt comment, which the merge train reads as a gate that
+  # did nothing and never offers the pull request again: Pliny-Bot #716 sat stranded that way after
+  # its repair was computed and then lost to a rejected git fetch in conclude.
   incomplete:
-    needs: [subject, protected_changes, agent, safe_outputs, validate_output]
+    needs: [subject, protected_changes, agent, safe_outputs, validate_output, conclude]
     if: >
        always() &&
        needs.subject.outputs.found == 'true' &&
@@ -700,7 +709,8 @@ jobs:
        (
          needs.agent.result != 'success' ||
          needs.safe_outputs.result != 'success' ||
-         needs.validate_output.outputs.valid != 'true'
+         needs.validate_output.outputs.valid != 'true' ||
+         needs.conclude.result == 'failure'
        )
     runs-on: agents-arc
     permissions:

package/loops/workflows/agent-refine.md

@@ -837,9 +837,11 @@ safe-outputs:
   # was sent with an incorrect parameter shape (20 bytes, missing body) and was accepted
   # with success by the bridge, consuming the 1-per-run quota". The prompt still says to
   # send the body once.
+  # `title:` lets refine set an English title when the issue was written in another language.
   update-issue:
     target: "*"
     max: 3
+    title:
   add-comment:
   # Split children. An oversized story becomes several implementable ones rather than
   # one issue nobody can land; the cap stops a runaway decomposition.
@@ -976,6 +978,13 @@ timeout-minutes: 90
    The visible line is for people and the marker is read by the workflow, which turns it into the
    `sp-N` label. A body without the marker gets no estimate label at all.
 
+   **Everything you write is in English, whatever language the issue was written in.** Bodies,
+   child issues, comments and questions are English. When the title of the issue you are refining
+   is not English, put an English title in the same `update_issue` call as the body, as
+   `{"issue_number":N,"title":"...","body":"..."}`: it carries the same meaning, short, with no
+   language tag. People write issues in their own language, and everything the workflow produces
+   from them (pull requests, commits, the run history) is read by everyone else in English.
+
 7. **One safe-output call per turn.** Never batch multiple safe-output calls into a single
    message: `update_issue`, `create_issue` and `add_comment` each go in their own turn, with
    nothing else in the message. The provider caps one response at a fixed size, and a batch of